Chainalysis says data and tokens of all users were compromised — Ars Technica

Blockchain analytics company Chainalysis said that during a cyberattack, attackers obtained the names, usernames, password hashes, and active tokens of all users of its platform. The company detected anomalous activity, after which it temporarily disabled the login page and the Know Your Transaction service, intended for real-time monitoring of threats to cryptocurrency assets.

Multivector attack

As Ars Technica reports, Chainalysis described the incident as a multivector cyberattack. According to the company, the attackers used offensive techniques supported by AI agents to gain unauthorized access to systems and internal tools.

Earlier, Chainalysis informed clients that a third party had accessed user identifiers, full names, email addresses, and organizational role labels. The company later clarified that the investigation had found that the data of all users had been compromised, including password hashes and active tokens.

More current news is available on the UA.News Telegram channel Telegram.

Access to services is being restored gradually

One component of the attack was an on-path attack — an attack on infrastructure through which traffic is transmitted between two parties. According to Chainalysis, this vector led to the compromise of some customers' passwords; the company said it had identified and eliminated it.

Chainalysis also restricted access to its Reactor and Data Solutions services. The company began gradually restoring customer access to KYT and Address Screening, asking them to provide trusted IP addresses for allowlisting. After access is restored, users must change their credentials. The company said it has not currently found evidence of access to investigation data or manipulation of Chainalysis attribution data.